Tag Info

Hot answers tagged

49

If you have a recent enough kernel and version of iptables you can use the TRACE target (Seems to be builtin on at least Debian 5.0). You should set the conditions of your trace to be as specific as possible and disable any TRACE rules when you are not debugging because it does spew a lot of information to the logs. TRACE This target marks packes so ...


21

If you have python lying around this will write the SMTP conversation to stdout. sudo python -m smtpd -n -c DebuggingServer localhost:25 http://docs.python.org/library/smtpd.html#debuggingserver-objects


19

First Order: Is it responsive? If you can't log in, there's bigger problems afoot. This generally comes in two flavors: hardware failure, and software failure. Both are potentially catastrophic. To prevent DFA errors, check the general hardware health first - a simple glance-over usually will suffice. Second Order: Are the system's underlying structures ...


19

Directories only ever grow in size, not shrink. Try moving all those files out into a a temporary directory (like log2) then rmdir the old directory and rename the temp one as the new permanent one.


11

If you have a recent enough kernel and version of iptables you can use the TRACE target (Seems to be builtin on at least Debian 5.0). You should set the conditions of your trace to be as specific as possible and disable any TRACE rules when you are not debugging because it does spew a lot of information to the logs. TRACE This target marks packes so ...


11

I don't have a ~= RHEL5 at hand, so the output shown is from a Fedora 20, though the process should be mostly the same (the name of the function has changed). You'd need to install the appropriate kernel-debug-debuginfo package for your kernel (assuming RHEL or derivative distro). This package provides a vmlinux image (an uncompressed not stripped version ...


10

When it comes to a single computer, generally you want to get a packet capture and then do some analysis on the packet capture that includes things like: Protocol Breakdown Packets Per second Top senders receivers etc I recommend using wireshark or maybe Microsoft Network Monitor. With Network Monitor you will get a process breakdown of the capture which ...


10

On another Linux distribution I use, the naked -connect verb doesn't actually import the root CA packages installed on the system. To get that, you need to add -CApath /etc/ssl/wherever/, where the path is the location of the root CA certificate bundles. Without CAPath: CONNECTED(00000003) depth=1 C = ZA, O = Thawte Consulting (Pty) Ltd., CN = Thawte SGC ...


8

I can't think of a direct solution, but I can think of a round about way of tracking a packet. Log each rule with a log prefix directive (--log-prefix "Rule 34") Generate a test packet or packet stream with scapy and set the TOS field to something unique grep the log file output for that TOS setting and see which rules logged it.


7

You should have a look at smtp-sink which is a part of Postfix. You don't have to run Postfix to make it work. Just install it to have the executable. Everything you need can be configured via command line parameters: http://www.postfix.org/smtp-sink.1.html


7

I guess the answer wasn't here because it's so simple! Here's what I figured out: Open SQL Server Profiler (in Performance Tools) File -> New Trace... Connect to your database Click the Events Selection tab Select only events which correspond to SQL queries finishing: RPC:Completed SQL:BatchCompleted Click Column Filters... Click Duration in the list ...


7

Here's one. You can also use a regex tester like this one, or this one.


7

It depends on what you want: In the large, you want to look at inotify to see all file accesses that any process makes. In the small, strace will let you watch the syscalls a particular process makes. Strace is pretty awesome. You can trace a process's calls to 'open' by doing strace -f -eopen $cmd, for instance. The man page has full details on syntax, ...


7

Another method of debugging your rules is to add an identical rule to the one you're interested in, but set the action to being: -j LOG --log-prefix "rule description" Every time your rule matches, you'll get a line in syslog with lots of useful information about the packet.


7

The strace command lists the systemcalls the application make as it is running. If you're not de developer: Section 2 of the system manual documents systemcalls helping you understand what is happening. man 2 poll DESCRIPTION poll() performs a similar task to select(2): it waits for one of a set of file descriptors to become ready to perform ...


6

Given an unstripped vmlinux with debugging symbols (typically included with "linux-devel" or "linux-headers" packages matching your kernel version), you can use the addr2line program included with binutils to translate addresses to lines in source files. Consider this call trace: Call Trace: [<ffffffff8107bf5d>] ? finish_task_switch+0x3d/0x120 ...


6

You can use the FIBMAP ioctl, as exemplified here, or using hdparm: / $ sudo /sbin/hdparm --fibmap /etc/X11/xorg.conf /etc/X11/xorg.conf: filesystem blocksize 4096, begins at LBA 0; assuming 512 byte sectors. byte_offset begin_LBA end_LBA sectors 0 1579088 1579095 8


6

You're looking for strace. Have a look here: https://wiki.ubuntu.com/Strace


6

It transpires that this issue was primarily down to my misunderstanding of the output of strace -r. The '-r' option gives the time (in seconds) since the last system call, not the time that the last system call took to execute. In this instance, the CPU was churning away performing some calculation, not processing the brk(). The issue here is now ...


6

After digging through the documentation (based on the other answers here), this is the process I ended up using: Capture the ETW log of the problem The easiest way to do this is using the Windows Performance Recorder. I'm not sure when it first appeared, but seems to be built in on recent versions of Windows. Set the profile to CPU usage. or use the ...


5

Three answers on one post: 1) Debug by script: #!/bin/bash debug() { if [ -n "$debug" ]; then $@ || echo -e "The command which launched the error:\n$@" else $@ fi } debug=1 IPTABLES="debug /sbin/iptables" $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP .... 2) Debug by syslog From this website ...


5

usually "who" followed by "last" a heap of issues on machines I've managed over times have been because of a very loose definition of "untouched" - often someone has done something :)


5

Run iptables -L -v (add -t nat for NAT rules), and you'll see packet and byte counters next to each of your rules. That'll show you which of your rules was the cause of a particular packet being accepted/rejected (whichever counter increased is the cause).


5

Have you ever tried waiting to see what HTTP status code returns? To debug this case, open 2 terminals: in the first, ssh to your server and type: # tcpdump -vv -s0 tcp port 80 -w /tmp/example.pcap (you can also append and src host <client_IP> to filter junk requests) and in the second, use wget to browse your website, reproduce this problem and ...


5

Go to Event Viewer, Applications and Services Logs, Microsoft, Windows, Dhcp-Client, Microsoft-Windows-DHCP Client Events/Operational. By default this trace log will be empty, because you need to enable it by clicking on “Enable log” on the right side. Source: http://texhex.blogspot.be/2011/12/debugging-dhcp-on-client.html


5

To this jaded eye, it looks like there is some kind of routing issue close to the server in question. Packets come in along one path, but seem to depart through a different path and something stateful is on that path and dropping the weird "ACK without a SYN" packets. I had this happen to me once. What ended up being the case was that the server had a bad ...


5

I had the same problem on a fresh install of Windows 2012. However, the freb.xsl file was present in the same folder as the event XML file. To get it to show the 'nice interface' I had to add "about:internet" to the IE11 trusted sites list, as discussed here: http://forums.iis.net/p/1147605/1862016.aspx


4

Try bash -x /my/script to print every line of the script as it is executed. Can't run the script like this? You can also add it to the shebang at the first line of the file. #!/usr/bin/bash -x


4

I suspect MTU problems whenever I get a suspicious network hang like this. Try cating a large text file (something over 4k), and see if that hangs the session, too. If it does, it's almost certain that you've got a small MTU somewhere along the path that's causing you issues (especially since it's time-of-day dependent; perhaps your traffic's taking a ...


4

If the freb.xsl file is missing from the directory that contains the log files, then the nice interface won't show. Rather than trying to find a website with the latest freb.xsl, I found on this page: http://blogs.iis.net/davcox/archive/2007/10/05/recovering-freb-xsl-after-deleting-it.aspx that if you just delete the directory that the xml files are ...



Only top voted, non community-wiki answers of a minimum length are eligible